LibJS: Store PrivateElement values in Handle<Value>

This fixes an issue where private element values were not always
protected from GC. I found two instances where this was happening:

- ECMAScriptFunctionObject did not mark m_private_methods
- ClassDefinitionEvaluation had two Vector<PrivateElement> that were
  opaque to the garbage collector, and so if GC occurred while
  constructing a class instance, some or all of its private elements
  could get incorrectly collected.

Userland/Libraries/LibJS/Runtime/Object.h

@@ -36,7 +36,7 @@ struct PrivateElement {
 
     PrivateName key;
     Kind kind { Kind::Field };
-    Value value;
+    Handle<Value> value;
 };
 
 class Object : public Cell {